{ "llm": { "conf": 0.49460265, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library package" }, "ml": { "v": "7", "eng": "2.4.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.27783915, "rte": "az", "prob": 0.27783915 } ], "prob": 0.27800378, "skip": [ { "rte": "az/nupkg", "why": "unavailable" }, { "rte": "az/nupkg", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000012834866538469214, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001142422388511477, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000008761882781982422, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00001245737075805664, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001428524683433352, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000013142824172973633, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000012248754501342773, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000012834866538469214, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000019917884856113233, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-28T18:31:51Z" }, "path": "Soenneker.Maf.Cache.4.0.95.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MMtS@9j-oD5rZB008@#000xb003wDwO=Ave]\u003eJtBcI*AyqIUAm^\u003e+.KB9fF!IXBG/\u003eH=7/P2Fav!%\u003cVz2PI:AC[5U4WnYn4@-3o\u0026AHdKw\u003cQboq9e1xJ4*jad+ww@!Cbp8XXKZcy{!)!cHCQ?Wu6I", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "6201b7ff64bf0d6b098ade6ec75d3787d4a8fc877e40e7952c899110fffe6353", "path": "Soenneker.Maf.Cache.4.0.95.nupkg", "risk": 4, "size": 37546, "type": "nupkg", "facts": { "metrics": { "file": { "size": 37546.0, "entropy": 7.92, "size_bytes": 37546.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 33792.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.65, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 36274.0, "compression.ratio": 0.76, "hidden_file_count": 2.0, "total_uncompressed": 48004.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25172.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Maf.Cache", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.maf.cache", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.maf.cache", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.95", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Maf.Cache", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 1268, "file": 6 } ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded HTTP or WebSocket URL", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 509.0, "entropy": 5.18, "size_bytes": 509.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 509.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!_rels/.rels", "pid": 0, "sha": "daf547d75c69056b4263ae72fa83e43512660b3378f46d81fee188cca8e225e7", "size": 509, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e\u003e]+^e\u003c\u003c5SxK%pVx\u003efymarR^HjA+pRB7]Mgj#s(Ce\u0026+^KflQ]EB7]Mgj{\u0026zParS^PB-.qnA=TApvqxA%q/uk+zE)P{AY=0-B-.qnA=TzKarR^HjzX.wwO#N2aAR)FwJ.kGCYmXmB8#5lzx.nsnMm/9y?Wx\u003czGxwM3lQDlauTEOv}xL0wMr+!k4]4WAc15[fkLujwO#N2B1RuMxjVfqz/PFzo?wqDfkLujwO#N2rDq[t3lQDlauTvFz/d:Mv@DlqAbGqJfkj{mzAXyIarR^?A+eV\u0026zdL[eml%somj@B/jtg.^vpTj^j{\u0026zParS^=A=kY7v@$Z\u003ey^8JOBz#pZfe3%LBzb/ae[n*pflq5yzF\u003c33wPxCBz!i*7wOU\u003c$e]t3ee[ns1xK%pVAb](iwN/*ZA+)]DarR^Hjy\u00262Av@=p5BzkVhk2uorC4\u003eG3zF782B9RUkaARpqwNPa3B75V(aAImmxkzd3z/cW(x\u003e8g4B8LVjavfTKzGE0\u003cA:-/@Cw?IqavfTKzGG}xx(n0lvqYN^B1PNdwmY*(A+PGmx(v(M3lQDlauTWQy?m3@wLNe=wPH4nAaAy0wGUI{AaJ]$wO#16ax9h\u0026zF\u003c33wPxy$vp?bWBz(jMpJgz\u0026z/fRsBz\u0026oUe?![liuPZ{gbHZmjtg.^y?m3@wLNe=wPH3xarR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Ewawc6TwGT]\u0026wO#x%yH}JGfjO{tD2^RixMMABarR^HjAL1AB3sCHw/$O(v}YA@ze0H2z/Y\u0026eBrC18wO#Pjw].r%wP@6kyANa}v}YN]xcpR%vp%d?BrCBew[bmVxK@reBzkLlv@(r(A=rdiz//(dBrC6ratdLyBuzi#vp%TB3lQDlauTWQAbP/iBz(hBaAR)FwJ.kIx(\u003eKwB-IpYb4#7uAc15[fk20vxMW=pv@DiqB8LSczE)P{AXzGLwO#x%yH}Jszdd3ev{@\u003eXwG\u0026maA:-\u0026}xGWLRvqfQ6ay/tbze18Pb4AGtv}5}cwI(z2fF+QBi5\u0026-GvpIbLh-SPFvMlk9hEXT1vpp]EviM*Ej{\u0026zParS^SwPhi#wmYT*x\u003equH3lQDlarR^?xl4{kA3fmhA+w%9mSI{OwP@6kyDS\u003eV", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 26, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 42, "z": 906, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1315.0, "entropy": 5.06, "size_bytes": 1315.0 }, "binary": { "overall_entropy": 5.06, "peak_region_bytes": 1315.0, "peak_region_entropy": 5.05 } } }, "id": 2, "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!Soenneker.Maf.Cache.nuspec", "pid": 0, "risk": 1, "sha": "2f92c16cd44beba8a26536d73ac676189c52167d65dcbd2113176bbd1c3f6422", "size": 1315, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 906 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1071, "entropy": 5.1 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.11 } } }, "id": 3, "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "da140132200c773c010aa7aa02521cb675b30437dca6b7e42ce0a1e925da2e0e", "size": 1071, "traits": [ { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 48, 0 ] ] } ], "type": "text" }, { "id": 4, "sha": "0fba23abe0e6e32ab18f46b2f2d3d7264c13b897c1c630a2564635201fd4f111", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!README.md", "size": 984, "type": "markdown", "depth": 1 }, { "id": 5, "sha": "93511e8937b27717eb154ee90eaf1655d4dbbad2865ecfc5a7d0bd794c945c49", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!icon.png", "size": 16083, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000K#\u0026Tz00000nb@R\u00260SSx7]DBnnKqv(%0rr91000000000000000000000000000000000000000000000000000000000000000009S^-c000uQ9S^-c000uQ9S*V?000cKiSZYE000uc1apgI00B^q0W[@!015=fEf6xG1oFV71{L5c26gZ-019=!000vO0@@r7dGxCG6efE/pxgv{0rr9i5=:s2000vO1POJ95=.#Y2lj-b5=-2Z2MK\u0026c5=-5.1][Sa5=-8-2(\u003c@d5=-U{1onA85=^p.000cm04m\u003cF04OVZD\u003c6GI1sLt(017iQ1s%/Yc)eG\u00263m#*f0rrasAUeoKAc0f501a2NDJKlF1oO=gzZ2eY3m.+KDJBfE1AEYD0b@:l7YTKpb]cPSc)FY(3iCLR000c71AbK=017ik0^:$G00Etq003%^0SSiJc)FY(3iCLR000c7zZCC:3mW}nDJKlF1oSM\u0026000uQa{6d{001IJdK1{x1onAL0XafI8..D@f-.mO0SSij0^+4I00ASgDJ%JJ1pCz]RVlX%0^+aK00BP11ss*k1T\u003eF[017p?ASDduAb(J\u003c0c005000vL2yuHL00Eu1003%PJtIS}0vnG.DK6PK1FNgU0^+aK00Ei\u0026000w2c)FY(3iCLU000duaohxG0^+aK00AvI2(\u003c@dzZ$!/3mD5T04OY^5^oWn000ut1qg?=e=U\u003eUeJ%jKb)]56", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "0^\u003edK00AMQgxmyZdGxCG0t2kh000Ge]-Cjjcia2DhuFmf000c7c]p]73mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnPA+C%byPQ)3\u003cV?k{Y{\u003c1bu5Y8x(mN8000001q7Rl.#P\u0026rbumUx:pXEM5c8Xgbs+:9l\u0026Wh!/B!e:Xc8^i", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 1268, "z": 4, "cf": 1.0 } ], "ln": 1220 }, { "b": "wb]LDwO#x%yH}Jso\u003c}S^lT:FrwDkp@vp?(nv}YANnP5Y\u0026yH)GAD2[7sz7X.ezGGPfwDkp/B9RUkq/(C\u0026wLDPyxLzu}08)DJq/(C\u0026wLDPyxLzu}0crl\u003cBy!fPv}YN]wDh", "n": [ { "c": 1, "d": "References the .NET Invoke member name", "i": "micro-behaviors/process/interpreter/reflection/runtime::invoke-token", "o": 3727, "z": 6, "cf": 0.6600000262260437 } ], "ln": 3695 }, { "b": "e\u003e72bwO#N6z/fRGr://!wMi8Vyxc\u003eoBu%.V08)/EzF\u003c33wPxy$vp?bVvpJ$Ze[w^m08[e:By/p?lT:\u003exwO=f\u003eBzkVhrbVL-zuafPzEWl]y*?B1z/eJ)yH}w-r://!wMi8VyEJF\u0026wO#N6z/bLGz!zTVw]zZbvruj4zu9yBv@=Hez!s8zmr\u0026]=zGxJgzGvA#wPhi#wmYT*C$z)*wN/*@z/bLND2[7sz7XZ$w]83*BzkVh07*a2A=#ebwKyxLy?m9#x(v\u003e?l2{QXzdNQbpiyw?mr\u0026rNAcb/jzu9QDBvyB:wPh:9z/bLOA^o@Ywk^hWxkzd3z/bLvwmOzyw\u003cZ0pxK%FJq!ZbZy?mZbzu94u", "n": [ { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 4729, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 4606, "z": 4, "cf": 0.5 } ], "ln": 4558 }, { "b": "xjV8-lVl\u003cOx\u003eINewN[?Iy\u0026%q*vrliICvticwPv=vwPQjZvqf*{ASv.4Bz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026)wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026Iz!i*7wOU\u003c$e\u003eoF\u003ce\u003e6V2zb$7YB.bQ]ju+PeuVY%}A@Yc:B94", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 4937, "z": 18, "cf": 0.75 } ], "ln": 4889 }, { "b": "Bo2lJBw=W\u003eB.(d1k$KvPwO#O\u0026lVM:DBy^:JwO#O\u0026q/(C*Bo23NC4BAWCYS{KA=LPl0b2\u003e+uQnsozGFuRv@#TfC(QoIAccv90000fzVB.RBo31PzVBUPA@Vhio-OP4w=", "n": [ { "c": 1, "d": "Bare Start member-name string", "i": "micro-behaviors/process/create/spawn::process-start-member-token", "o": 5578, "z": 5, "cf": 0.7799999713897705 } ], "ln": 5546 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKb()#*lVl{?A+Pf1BrFD1atLSahxUR2yH[R!z!i*7wOU\u003c$0034208VNkz*2\u00269x(mMavrlZiv\u003c2(bA+eV\u0026ePUujwGV5dzF9=%Bz(4to\u003e!9Tz/Y\u0026eBrA\u003eZwO#PjmSI{OwP@6kyAL]QwO#Qhao", "n": [ { "c": 3, "d": "Hardcoded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 6802, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 6841, "z": 9, "cf": 0.6000000238418579 } ], "ln": 6738 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^DisiF0000000000Diu5800341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4003va000c4003vakl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 7774, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 7680, "z": 5, "cf": 0.8999999761581421 } ], "ln": 7648 }, { "b": "006Cf00031fAr^bfAr^bfAr{fvGn7Z006UiqucZ$lJz38z2!zMwDlPFBo3vZ002*}ASy1TB]VjRwb{rzzuaqHaok*IA@ZE=zuaeDaolG-xAi5MwDlcswb[gYA@YRGw=MxxaolD.x-J2Jx8(-FwDl/LzVBUPaokaox-ISyASy1TA@ZaUw=M]MaojXcx8(Gyzua+Uaoj\u003ehASxIFz2!bECk#KYASx\u003ePaojXcx8(Gyzua+UA@Wr.x-J2JA@ZpZve$fBv/Q6uA@W/)002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=XPCve%)te=Xlsve%^qxAhPz001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=W)ih2]lefAq7M002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=XPCve%)te=Xlsve%^qxAhPze=YzZyYFnK003KfaohAxoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaonwvaojd%fAr\u003cdhuj\u003c1n=So1yxd]CaoksuzVBtGzuaLOwDlGCwDl-J003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGCwDl-Je=XPCve%)te=Xlsve%^qxAhPze=YzZyYFnK002K\u00266AwdlpYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBtGzuaLOwDlGCwDl-Je=XPCve%)te=Xlsve%^qxAhPz004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=W)ih2]cbv/Ov^vGo)rvGo)rh#)H\u0026h2]MnfAr^bgxorkhukYph#\u003e=nfAtIYv/Os=hukVoirg=lg5$+-h#\u003e/oirg@qvGnv/fAtIYve@4.gxp?-0024W2(\u003c#ak(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=W)ih2]lefAq7M000000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 8182, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 8258, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 8338, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 8390, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 8730, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 8760, "z": 47, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 8570, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 7994, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 8208, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 8292, "z": 19, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 8500, "z": 32, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 8684, "z": 19, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 8364, "z": 8, "cf": 0.949999988079071 } ], "ln": 7962 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncV]Xl/00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 9216, "z": 6, "cf": 0.8999999761581421 } ], "ln": 9168 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 7168, 5.57, "r-x" ], [ ".rsrc", 7680, 1536, 2.85, "r--" ], [ ".reloc", 9216, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 53199.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.95, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 9728.0, "entropy": 4.93, "size_bytes": 9728.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.57, "string_count": 158.0, "overall_entropy": 4.93, "entropy_variance": 5.03, "avg_string_length": 20.58, "max_string_length": 81.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.83, "string_length_stddev": 14.2, "largest_section_ratio": 0.74, "sentence_string_count": 10.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 7168.0, "entropy_max": 5.57, "entropy_mean": 2.84, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!lib/net10.0/Soenneker.Maf.Cache.dll", "pid": 0, "risk": 4, "sha": "334a610c0786814a316104de941367abe54e3393aedd07b46322cea59f197949", "size": 9728, "traits": [ { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1268, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7774, 15 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 8338, 11 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 8258, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8760, 47 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 8730, 14 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 8182, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 8390, 12 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded HTTP or WebSocket URL", "spans": [ [ 6802, 21 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 1268, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "cd782aa20944e23673318ac69d5fb5f76ccd1d9ad5ea4711e89385af38622a78", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!lib/net10.0/Soenneker.Maf.Cache.xml", "size": 3848, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "685762e8e871887e2fef7802aa3166269668991215eae8af937ff289aed0681b", "path": "Soenneker.Maf.Cache.4.0.95.nupkg!!package/services/metadata/core-properties/c390421188e9423d8ee38ca620b671b7.psmdcp", "size": 771, "type": "xml", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "19e9634bfed3c4f0b8448a82052d607a1f8636c44cf938b912b41f53e4115bc5", "path": "Soenneker.Maf.Cache@4.0.95.registry.json", "risk": 1, "size": 974, "type": "registry", "depth": 1 } ], "omitted_files": 6, "v": "8" } }